feat(backend)!: kill AbstractWizard, env-driven config + hf-cli

Drops the AbstractWizard config-volume bootstrap entirely. All deploy-time
config now comes from docker env vars (.env). First-deploy admin user + OIDC
provider config are operator-driven via `docker exec hf_backend hf-cli ...`.

Backend changes:
- entrypoint.sh: drop config-wait loop, just exec uvicorn
- app/core/config.py: drop _resolve_db_url + OIDC_* env vars (DB only now);
  keep HARBORFORGE_OIDC_ONLY (deploy-time policy)
- app/init_wizard.py → app/init_bootstrap.py: drop load_config / admin / OIDC /
  default-project bootstrap; keep idempotent startup seed (permissions,
  default roles, acc-mgr + deleted-user builtins)
- app/main.py: /config/status now returns {initialized: <admin exists>};
  startup() imports init_bootstrap.run_bootstrap
- app/api/routers/oidc.py: get_effective_oidc reads DB only (no env fallback)
- app/services/harborforge_config.py: removed (replaced by direct env reads)
- app/services/discord_wakeup.py: HF_DISCORD_GUILD_ID / HF_DISCORD_BOT_TOKEN env
- app/api/routers/users.py + tests/conftest.py: rename init_wizard refs

New hf-cli surface (app/cli/, invoked via /usr/local/bin/hf-cli shim):
  hf-cli admin create-user --email <e> [--username <u>] [--password <p>]
                            [--oidc-issuer <url> --oidc-subject <sub>]
  hf-cli admin list
  hf-cli admin set-role --username <u> --role <admin|mgr|dev|guest|account-manager>
  hf-cli admin reset-password --username <u> --password <p>
  hf-cli admin bind-oidc --username <u> --oidc-issuer <url> --oidc-subject <sub>
  hf-cli config oidc [--issuer/...] [--client-id/...] [--client-secret/...]
                     [--redirect-uri/...] [--enabled true|false] [--show-secret]

Bootstrap migration on existing deployments: existing admin / OIDC settings
in the DB are preserved across the cutover; only the wizard config-volume
+ wizard sidecar services need to be removed from compose. Restart picks
up the new entrypoint + skips the config wait.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/main.py

@@ -42,24 +42,22 @@ def version():
 
 @app.get("/config/status", tags=["System"])
 def config_status():
-    """Check if HarborForge has been initialized (reads from config volume).
-    Frontend uses this instead of contacting the wizard directly."""
-    import os, json
-    config_dir = os.getenv("CONFIG_DIR", "/config")
-    config_file = os.getenv("CONFIG_FILE", "harborforge.json")
-    config_path = os.path.join(config_dir, config_file)
-    if not os.path.exists(config_path):
-        return {"initialized": False}
+    """Has the deployment been bootstrapped (admin user exists)?
+
+    Frontend hits this on mount to decide whether to show login or a
+    "no admin yet, run hf-cli admin create-user" placeholder. With the
+    wizard removed in v0.4.0 the only deploy-time bootstrap step is the
+    operator running `docker exec hf-backend hf-cli admin create-user ...`
+    once; this endpoint just reports whether that has happened.
+    """
+    from app.core.config import SessionLocal
+    from app.models import models
+    db = SessionLocal()
     try:
-        with open(config_path, "r") as f:
-            cfg = json.load(f)
-        return {
-            "initialized": cfg.get("initialized", False),
-            "backend_url": cfg.get("backend_url"),
-            "discord": cfg.get("discord") or {},
-        }
-    except Exception:
-        return {"initialized": False}
+        admin_count = db.query(models.User).filter(models.User.is_admin == True).count()  # noqa: E712
+        return {"initialized": admin_count > 0}
+    finally:
+        db.close()
 
 # Register routers
 from app.api.routers.auth import router as auth_router
@@ -494,11 +492,13 @@ def startup():
     Base.metadata.create_all(bind=engine)
     _migrate_schema()
 
-    # Initialize from AbstractWizard (admin user, default project, etc.)
-    from app.init_wizard import run_init
+    # Idempotent startup seed: permissions, default roles, built-in
+    # accounts (acc-mgr, deleted-user). The admin user + OIDC config are
+    # NOT created here — they're operator-driven via hf-cli.
+    from app.init_bootstrap import run_bootstrap
     db = SessionLocal()
     try:
-        run_init(db)
+        run_bootstrap(db)
         _sync_default_user_roles(db)
     finally:
         db.close()